CVE-2026-108583: zotero-mcp SSRF vulnerability via prompt injection

zotero-mcp versions 0.10.0 through 0.14.1 contain a server-side request forgery vulnerability in the _fetch_embedded_metadata function that lacks destination validation. Attackers can use prompt injection to steer agents into calling zotero_add_by_url to reach internal services and leak sensitive information.

Disclosed 10 October 2026 · Record updated 10 October 2026

Impact

Attackers can reach internal services, loopback addresses, and private hosts through prompt injection, potentially leaking citation metadata and error details

Our coverage

A puppet master's strings guide a mechanical servant to retrieve forbidden documents from locked rooms behind a castle wall.

Vulnerabilities

Zotero MCP server flaw lets prompt injection probe internal networks

A server-side request forgery bug in zotero-mcp versions 0.10.0 to 0.14.1 lets attackers steer agents into fetching URLs on private hosts, according to NVD.

10 Oct 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-108583